A vulnerability has been discovered in itsourcecode Online Doctor Appointment System 1.0 that allows an attacker to manipulate the patient_id parameter in the file /admin/patient_action.php, resulting in a classic SQL injection flaw. This flaw permits the execution of arbitrary SQL commands against the underlying database, potentially exposing sensitive patient records, modifying or deleting data, and undermining the integrity of the system. The weakness is identified as CWE‑74 (Improper Neutralization of Special Elements used in an SQL Command) and CWE‑89 (Improper Neutralization of Input During Database Query).

Affected systems include the itsourcecode Online Doctor Appointment System version 1.0, which is distributed under the CPE cpe:2.3:a:unguardable:online_doctor_appointment_system:1.0. No other versions are explicitly documented as vulnerable, so users should verify whether newer releases contain the fix.

The severity rating of CVSS 6.9 indicates a medium to high impact, and an EPSS score of less than 1% suggests a low probability of exploitation at this time. The vulnerability is publicly disclosed and can be triggered remotely without authentication, so it presents a moderate to high risk when exposed to the internet. It is not listed in the CISA KEV catalog, but the combination of a remote attack vector, the sensitive data involved, and the lack of immediate mitigation make it important to address promptly.